Before the first call.

Corporate IT teams, MSSPs, MSPs and resellers. An IT team uses it to measure and improve the security of its own organisation. A service provider uses it to run the same cycle as a recurring service for each customer, under its own brand.

Watcher monitors 24/7, correlates and prioritises the findings from your Buguardian services and calls you with the recommended steps. The action is taken by your own team or your solution partner, with the road map in hand. You get round-the-clock monitoring without hiring analysts.

No. Buguardian is a platform that your IT team or your service provider operates. Watcher assesses, prioritises, alerts and reports; it does not provide staffed incident response.

No. Buguardian is not an antivirus, EDR or backup product. It measures your exposure and works alongside the protection and backup tools you already have.

No. Every service runs on its own. Start with the ones you need and add the rest later; each one adds its findings to the same company record and the same score.

English, Turkish and Spanish.

For internal network scans, one scanning appliance: an Ubuntu virtual machine with at least 4 cores, 8 GB of memory and 100 GB of disk. For inventory and patching, the endpoint agent on each machine. Web scanning, threat intelligence, certificate and blocklist monitoring start from a domain you verify with a DNS record.

As a cloud service (SaaS). It is live in days, with nothing to install for external services.

The Active Directory and database health checks are read-only. No account, group, policy or other object is created, changed or deleted.

Passwords and secrets are encrypted with AES-256 and are never displayed again after you save them. You can limit a credential to specific IP addresses or ranges. Monitoring targets and their credentials stay on the appliance in your network.

Deployments open ring by ring. If the pilot ring fails, or the failure threshold you set is exceeded, the rollout stops there. You can also set maintenance windows, exclude an update with a justification, and roll a patch back.

Operators sign in with their own account and are granted access company by company and capability by capability — screen, keyboard and mouse, file transfer, services, processes, event log. A second factor is required to enter the remote console, and access can be revoked at any time.

Two things. It analyses the findings from every service and writes a briefing: observation, analysis, decision. Then it prepares the matching actions in the console — such as a patch deployment or a verification scan — and runs them after you approve.

By level. An alarm, which needs immediate action, reaches you 24/7 by voice call and email. A warning arrives the same day by email with the steps to close it. Advisories are collected in the AI-written executive report each period.

No. Every action is proposed with its reason and scope and runs only after a person approves it. Actions go through the same controls as manual operations, and each one is recorded.

No. Only numerical summaries and ratios are passed to the AI layer; raw records are not sent. Data produced in your environment stays there, and alerts sent outside your organisation do not include vulnerability details.

Seven weighted categories combine into a number from 0 to 100: technical vulnerability 30%, human factor 20%, data leakage 15%, web vulnerability 10%, firewall posture 10%, identity and directory 10%, operational continuity 5%. The calculation is deterministic and uses only the last completed result from each service.

No. The posture score is calculated deterministically from published weights. Watcher explains the score and works to improve it. If the AI service is unavailable, the calculated score does not change.

No. A service outside your scope does not lower the score; its weight is redistributed to the measured categories. A licensed service that stops reporting is shown as a visibility gap.

No. Because unmeasured weight is redistributed, a score from a limited assessment can look like one from a full assessment. Every report states which categories were measured, which were out of scope and which have stale or missing data.

PDF reports for the posture score, network scans, web scans, phishing campaigns, firewall analysis, Active Directory health checks and threat intelligence — plus a one-page executive report each period.

Yes. Distributors, solution partners and customers each have their own level, and every customer has an isolated workspace. One login covers all of them.

Yes. The panel, the reports and the communication can carry your brand, while the operation runs on Buguardian.

Per company, as a one-month demo, an annual licence or a three-year licence. Prices are quoted on request.

Buguardian Management and ThreatAuthenticator are licensed per agent per month, from a minimum of 10 licences, with no distinction between servers and clients.

You buy capacity and spend it across services and tenants as demand appears — for example, on-demand threat reports and re-tests. There is no upfront infrastructure investment.

No. Buguardian produces recurring technical evidence that can support security reviews, customer questionnaires and selected control assessments. It does not issue certifications or guarantee compliance, and it does not replace legal advice or independent assessment.

ISO/IEC 27001:2022, NIST CSF 2.0, NIS2, GDPR and, in Türkiye, KVKK, depending on jurisdiction and deployment. See the compliance mapping page for the control-by-control table.

No. It is an optional, restricted assessment, subject to availability and scope. It runs only with explicit authorisation, documented scope, provider permission, rate limits, agreed test windows and an emergency stop.